Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.
1. A method for detecting an unknown undesirable event, comprising: in a computer system: a) receiving a dataset comprising a plurality n of multidimensional datapoints (MDDPs) with a dimension m≥2 and wherein n>>m; b) applying whitening principal component analysis (WPCA) to obtain a lower dimension embedded space with a dimension smaller than m; c) embedding the MDDPs into the lower dimension embedded space to obtain embedded MDDPs; d) calculating distributions of distances D i nn , i=1 . . . n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold D t nn ; e) classifying a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP if a respective distance D i nn of the particular MDDP or NAMDDP is larger than threshold D t nn , wherein the particular MDDP or NAMDDP classified as abnormal is indicative of the unknown undesirable event; and f) computing a score that indicates the magnitude of the abnormality, whereby the whitening and the embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
A method for automatically and unsupervised detecting an unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. Finally, a score is computed to quantify the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
2. The method of claim 1 , wherein the calculating distributions of distances D i nn , i=1, . . . , n of each embedded NMDDP from a plurality of nearest-neighbors (nn) to compute a threshold D t nn includes applying a Gaussian mixture to each distribution to obtain Gaussian weights and using the Gaussian weights to compute threshold D t nn .
A method for automatically and unsupervised detecting an unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors, specifically by applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these weights to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. Finally, a score is computed to quantify the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
3. The method of claim 2 , wherein the applying a Gaussian mixture to each distribution to obtain Gaussian weights and using the Gaussian weights to compute threshold D t nn includes computing threshold D t nn from a posterior probability for each element in D i nn .
A method for automatically and unsupervised detecting an unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors. This calculation specifically involves applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these Gaussian weights to compute a threshold by calculating it from a posterior probability for each individual distance element. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. Finally, a score is computed to quantify the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
4. The method of claim 2 , further comprising computing a score that indicates the magnitude of the abnormality.
A method for automatically and unsupervised detecting an unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors, specifically by applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these weights to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. In addition to detection, a score is computed that indicates the magnitude of the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
5. The method of claim 1 , wherein the classifying includes classifying the particular MDDP of the dataset or the NAMDDP as an abnormal MDDP offline.
A method for automatically and unsupervised detecting an unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event, and this classification is performed offline. Finally, a score is computed to quantify the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
6. The method of claim 1 , wherein the classifying includes classifying the particular MDDP of the dataset or the NAMDDP as an abnormal MDDP online.
A method for automatically and unsupervised detecting an unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event, and this classification is performed online (in real-time). Finally, a score is computed to quantify the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
7. The method of claim 1 , wherein the unknown undesirable event is selected from the group consisting of a cyber-threat, a cyber-attack, an operational malfunction, an operational breakdown, a process malfunction, a process breakdown, a financial risk event, a financial threat event, a financial fraud event, money laundering and a financial network intrusion event.
A method for automatically and unsupervised detecting a specific unknown undesirable event in a computer system. This involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The system calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold. This abnormal MDDP indicates a specific unknown undesirable event, such as a cyber-threat, cyber-attack, operational malfunction or breakdown, process malfunction or breakdown, financial risk event, financial threat event, financial fraud event, money laundering, or a financial network intrusion event. Finally, a score is computed to quantify the abnormality. This WPCA and embedding process reduces memory usage and speeds up computations.
8. A computer program product, comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: a) receiving a dataset comprising a plurality n of multidimensional datapoints (MDDPs) with a dimension m≥2 and wherein n>>m; b) applying whitening principal component analysis (WPCA) to obtain a lower dimension embedded space with a dimension smaller than m; c) embedding the MDDPs into the lower dimension embedded space to obtain embedded MDDPs; d) calculating distributions of distances D i nn , i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold D t nn ; and e) classifying a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP if a respective distance D i nn of the particular MDDP or NAMDDP is larger than threshold D t nn , wherein the particular MDDP or NAMDDP classified as abnormal is indicative of the unknown undesirable event, whereby the whitening and the embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
A computer program product, stored on a non-transitory tangible medium, contains instructions for a processing circuit to perform a method for automatically and unsupervised detecting an unknown undesirable event. The method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The program calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. This WPCA and embedding process reduces computer memory needs and speeds up computing operations.
9. The computer program product of claim 8 , wherein the calculating distributions of distances D i nn , i=1, . . . , n of each embedded NMDDP from a plurality of nearest-neighbors (nn) to compute a threshold D i nn includes applying a Gaussian mixture to each distribution to obtain Gaussian weights and using the Gaussian weights to compute threshold D t nn .
A computer program product, stored on a non-transitory tangible medium, contains instructions for a processing circuit to perform a method for automatically and unsupervised detecting an unknown undesirable event. The method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The program calculates distributions of distances for each embedded MDDP from its nearest neighbors, specifically by applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these weights to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. This WPCA and embedding process reduces computer memory needs and speeds up computing operations.
10. The computer program product of claim 9 , wherein the applying a Gaussian mixture to each distribution to obtain Gaussian weights and using the Gaussian weights to compute threshold D t nn includes computing threshold D t nn from a posterior probability for each element in D i nn .
A computer program product, stored on a non-transitory tangible medium, contains instructions for a processing circuit to perform a method for automatically and unsupervised detecting an unknown undesirable event. The method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The program calculates distributions of distances for each embedded MDDP from its nearest neighbors. This calculation specifically involves applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these Gaussian weights to compute a threshold by calculating it from a posterior probability for each individual distance element. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. This WPCA and embedding process reduces computer memory needs and speeds up computing operations.
11. The computer program product of claim 8 , wherein the method further comprises computing a score that indicates the magnitude of the abnormality.
A computer program product, stored on a non-transitory tangible medium, contains instructions for a processing circuit to perform a method for automatically and unsupervised detecting an unknown undesirable event. The method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The program calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event. The method performed by the program product further includes computing a score that indicates the magnitude of the abnormality. This WPCA and embedding process reduces computer memory needs and speeds up computing operations.
12. The computer program product of claim 8 , wherein the classifying includes classifying the particular MDDP of the dataset or the NAMDDP as an abnormal MDDP offline.
A computer program product, stored on a non-transitory tangible medium, contains instructions for a processing circuit to perform a method for automatically and unsupervised detecting an unknown undesirable event. The method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The program calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event, and this classification is performed offline. This WPCA and embedding process reduces computer memory needs and speeds up computing operations.
13. The computer program product of claim 8 , wherein the classifying includes classifying the particular MDDP of the dataset or the NAMDDP as an abnormal MDDP online.
A computer program product, stored on a non-transitory tangible medium, contains instructions for a processing circuit to perform a method for automatically and unsupervised detecting an unknown undesirable event. The method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The program calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as abnormal if its distance exceeds this threshold, indicating an unknown undesirable event, and this classification is performed online (in real-time). This WPCA and embedding process reduces computer memory needs and speeds up computing operations.
14. A computer system, comprising: a hardware processor configurable to perform a method comprising steps of: a) receiving a dataset comprising a plurality n of multidimensional data points (MDDPs) with a dimension m≥2 and wherein n>>m; b) applying whitening principal component analysis (WPCA) to obtain a lower dimension embedded space with a dimension smaller than m; c) embedding the MDDPs into the lower dimension embedded space to obtain embedded MDDPs; d) calculating distributions of distances D j nn , i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold D t nn ; and e) classifying a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP if a respective distance D i nn of the particular MDDP or NAMDDP is larger than threshold wherein the particular MDDP or NAMDDP classified as abnormal is indicative of the unknown undesirable event, whereby the whitening and the embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
A computer system with a hardware processor is configured to detect unknown undesirable events by performing a method. This method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The processor calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as an abnormal MDDP if its distance exceeds this threshold, indicating an unknown undesirable event. The WPCA and embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
15. The computer system of claim 14 , wherein the calculating distributions of distances D i nn , i=1 . . . n of each embedded NMDDP from a plurality of nearest-neighbors (nn) to compute a threshold D t nn includes applying a Gaussian mixture to each distribution to obtain Gaussian weights and using the Gaussian weights to compute threshold D t nn .
A computer system with a hardware processor is configured to detect unknown undesirable events by performing a method. This method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The processor calculates distributions of distances for each embedded MDDP from its nearest neighbors, specifically by applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these weights to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as an abnormal MDDP if its distance exceeds this threshold, indicating an unknown undesirable event. The WPCA and embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
16. The computer system of claim 15 , wherein the applying a Gaussian mixture to each distribution to obtain Gaussian weights and using the Gaussian weights to compute threshold includes computing threshold D t nn from a posterior probability for each element in D i nn .
A computer system with a hardware processor is configured to detect unknown undesirable events by performing a method. This method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The processor calculates distributions of distances for each embedded MDDP from its nearest neighbors. This calculation specifically involves applying a Gaussian mixture model to each distribution to obtain Gaussian weights, and then using these Gaussian weights to compute a threshold by calculating it from a posterior probability for each individual distance element. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as an abnormal MDDP if its distance exceeds this threshold, indicating an unknown undesirable event. The WPCA and embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
17. The computer system of claim 14 , wherein the method further comprises computing a score that indicates the magnitude of the abnormality.
A computer system with a hardware processor is configured to detect unknown undesirable events by performing a method. This method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The processor calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as an abnormal MDDP if its distance exceeds this threshold, indicating an unknown undesirable event. The method further includes computing a score that indicates the magnitude of the abnormality. The WPCA and embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
18. The computer system of claim 14 , wherein the classifying includes classifying the particular MDDP of the dataset or the NAMDDP as an abnormal MDDP offline.
A computer system with a hardware processor is configured to detect unknown undesirable events by performing a method. This method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The processor calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as an abnormal MDDP if its distance exceeds this threshold, indicating an unknown undesirable event, and this classification is performed offline. The WPCA and embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
19. The computer system of claim 14 , wherein the classifying includes classifying the particular MDDP of the dataset or the NAMDDP as an abnormal MDDP online.
A computer system with a hardware processor is configured to detect unknown undesirable events by performing a method. This method involves receiving a dataset of many multidimensional datapoints (MDDPs) with a high number of datapoints relative to their dimensions (n>>m). Whitening Principal Component Analysis (WPCA) is applied to reduce the dimensionality of the data, creating a lower-dimension embedded space. The MDDPs are then embedded into this space to become embedded MDDPs. The processor calculates distributions of distances for each embedded MDDP from its nearest neighbors, using these to compute a threshold. Any particular MDDP or newly arrived MDDP (NAMDDP) is classified as an abnormal MDDP if its distance exceeds this threshold, indicating an unknown undesirable event, and this classification is performed online (in real-time). The WPCA and embedding in a lower dimension space reduce computer memory needs and speed up computing operations.
Unknown
July 21, 2020
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.